Spam vs phishing: what's the difference?

Spam and phishing both show up as unwanted email, so it's easy to mix them up. But they're not the same thing. Spam is junk mail that wants your attention. Phishing is a scam that wants you to do something, like sign in, pay or open a file. This guide explains the difference in plain language, with examples, so you know which is which and what to do with each.

What is the difference between spam and phishing?

Spam is unwanted email sent in bulk, usually to sell something. Phishing is a scam that pretends to come from someone you trust so it can steal your password, money or personal details. Spam is mostly a nuisance. Phishing is a crime aimed at you.

A good one-line test: spam wants your attention; phishing wants an action.

What is spam?

Spam is email you didn't ask for, sent to lots of people at once. Most of it is advertising: cheap products, dubious offers, "business opportunities". The FTC puts it plainly: "At best, spam emails are annoying. At worst, they're pushing scams or trying to install malware on your device" (FTC).

Not every unwanted email is spam. Newsletters and promotions you once signed up for are legitimate, even if you're tired of them. That kind of mail is sometimes called graymail; our guide to graymail vs spam explains it.

In the US, the CAN-SPAM Act sets rules for commercial email. The FTC's compliance guide says senders must not use false or misleading header information, the subject line "must accurately reflect the content of the message", the message must include a valid physical postal address, and senders "must honor a recipient's opt-out request within 10 business days." Real spammers ignore these rules, which is one way to spot them.

Example of a spam email

This is an example written for this guide.

From: Mega Deals <offers@best-bargains-daily.biz>
Subject: 80% OFF smart watches - TODAY ONLY!!!

Huge clearance sale! Premium smart watches from just $19.
Free shipping worldwide. Limited stock.

[ Shop now ]

To stop receiving these emails click here.

It's unwanted and probably low quality, but it doesn't pretend to be anyone you know, and it doesn't ask for your password.

What is phishing?

Phishing is a scam email that pretends to come from a trusted company, colleague or service. CISA defines it this way: "Phishing attacks use email or malicious websites to solicit personal information by posing as a trustworthy organization" (CISA). The FTC says scammers use email or text messages "to trick you into giving them your personal and financial information" (FTC).

Phishing often copies brands people use every day, such as Microsoft, Google, Amazon, PayPal or a bank. At work it may pretend to be your boss or a supplier asking for a payment. For a deeper explanation of types and tactics, see what is phishing.

Example of a phishing email

This is an example written for this guide.

From: Microsoft 365 <no-reply@m365-account-verify.com>
Subject: Your mailbox will be disabled today

Dear user,

We detected unusual activity on your account. To avoid
losing access, verify your password within 24 hours.

[ Verify account ]

Microsoft Security Team

It pretends to be Microsoft, creates panic, and wants you to type your password into a fake page. That's phishing.

How can I tell if an email is spam or phishing?

Ask what the email wants from you. If it just wants you to look at an offer, it's probably spam. If it wants you to sign in, pay, share details, call a number or open a file, treat it as phishing. Use this checklist.

1. Who does it claim to be? Phishing pretends to be someone you know. Spam usually doesn't.
2. Does the sender's address match? Check the actual address, not just the name. "Microsoft" sending from m365-account-verify.com is fake. CISA warns that "The sender's address may imitate a legitimate business."
3. Is there pressure? A deadline, a threat to close your account, or a warning about a "problem" is a strong phishing sign.
4. Does it ask for something? A password, a code, card details, a payment or a gift card. Real companies don't ask for your password by email. Gmail, for example, says it "won't ever ask you for personal information, like your password, over email" (Gmail Help).
5. Where does the link go? Hover over it (or press and hold on a phone) to see the real address. See how to check if a link is safe.
6. Is there an unexpected attachment? CISA says an unsolicited email asking you to open an attachment "is a common delivery mechanism for malware."

If you're still not sure, contact the company or person yourself, using a website or phone number you already know, not the details in the email. Our full guide to spotting a phishing email has more examples.

Is spam illegal? Is phishing?

Spam isn't automatically illegal in the US, but breaking the rules for commercial email is. CAN-SPAM is an opt-out law: it sets rules for how commercial email is sent rather than banning it. The FTC's compliance guide says the law "doesn't apply just to bulk email" and covers any message whose primary purpose is "the commercial advertisement or promotion of a commercial product or service". It adds that "The law makes no exception for business-to-business email."

The penalties are real. The FTC says: "Each separate email in violation of the CAN-SPAM Act is subject to penalties of up to $53,088" (at the time of writing, November 2026). The same guide notes criminal penalties, including prison, for practices such as harvesting email addresses or using someone else's computer to send spam without permission. Other countries have their own rules, often stricter.

Phishing is a different matter. It isn't a marketing practice with rules to follow; it's fraud. The FBI's IC3 tracks phishing as a crime type, and the FTC asks you to report it at ReportFraud.ftc.gov. In practice, the legal difference matters less to you than the practical one: a spammer wants you to buy, while a phisher wants to take. If you get unwanted sales email from a real company, our guide to stopping cold sales outreach explains your options.

Is email spoofing spam or phishing?

Spoofing is a trick, not a separate type of email. It means faking the sender's address so a message looks like it came from someone else, such as your bank, your boss or even you. Spam can be spoofed, but spoofing is most common in phishing, because pretending to be a trusted sender is the whole point. See what is email spoofing for how it works and how domain owners stop it with SPF, DKIM and DMARC.

If you run a business domain, check that it's protected: the free DMARC Checker shows whether receivers are told to reject mail that fakes your address.

Is opening spam or phishing dangerous?

Opening and reading either one is usually safe in an updated mail app. The danger comes from clicking links, opening attachments or replying. Our plain-language guide, is it safe to open a spam email?, explains exactly what can happen at each step.

If you already clicked a phishing link or typed a password, act now: follow what to do after clicking a phishing link.

Which is more dangerous, spam or phishing?

Phishing is much more dangerous. A spam email wastes your time. A phishing email can cost you your email account, your savings or your company's money. The FBI's Internet Crime Complaint Center (IC3) received 191,561 phishing and spoofing complaints in 2025, more than any other crime type in its 2025 report. For more numbers, see our phishing statistics.

Email filters treat them differently too. In Microsoft 365, the default anti-spam policy moves ordinary spam to the Junk Email folder, but quarantines high confidence phishing, where users can't release it themselves (Microsoft Learn, at the time of writing, November 2026). Our guide to how spam filters work explains the scoring behind these decisions.

Should I report spam and phishing differently?

Yes. Mail apps have separate buttons, and using the right one helps the filter learn.

• Gmail: For spam, select the message and click Report spam; Gmail says reported emails are "added to Spam" (Gmail Help). For phishing, open the message, click More next to Reply, and choose Report phishing (Gmail Help).
• Outlook and Microsoft 365: Select the message, select Report, then choose Report junk or Report phishing. Microsoft says a message reported as junk is moved to the Junk Email folder and the sender is added to your Blocked Senders list, while a message reported as phishing is deleted. With a work or school account, your admin decides whether reports go to Microsoft, to a company reporting mailbox, or both (Microsoft Learn).
• Apple Mail: Use the Junk button.

In the US, you can also forward phishing to reportphishing@apwg.org and report it at ReportFraud.ftc.gov, the FTC says. Our guide to reporting a phishing email has step-by-step instructions for each app. If you keep getting lots of plain spam, our guide to why you get so much spam explains what helps.

How can a business cut both spam and phishing?

A business can cut both by filtering mail before it reaches staff. Filtering at the edge of your email checks every inbound message for spam, phishing, spoofing and malware, then holds suspect mail in a quarantine people can review. Staff see less junk and make fewer risky decisions. Our page for small businesses explains how iBlockSpam does this in front of Microsoft 365, Google Workspace and other mail servers.

Next steps

1. Remember the test: spam wants your attention, phishing wants an action.
2. Use Report phishing for anything that pretends to be someone you trust, and Report spam for junk ads.
3. Never sign in, pay or open a file from an email you didn't expect. Go to the website yourself.
4. Paste a suspicious message's headers into the free Email Header Analyzer to see who really sent it.
5. If your team gets too much of either, see how iBlockSpam protects small businesses.